Blessed ForcedLeak, Who Emptied the CRM for Five Dollars

Patron of AI agents that read everything, Web-to-Lead forms, and domains left to expire.

Life

On 25 September 2025 Noma Security made public ForcedLeak, an indirect prompt injection in Salesforce Agentforce. The attacker hid instructions in the description field of a Web-to-Lead form; when an employee asked the agent to deal with that lead, the agent obeyed and shipped CRM data inside an image URL. The destination was a domain still allowed by Salesforce's Content Security Policy but expired, which the researchers bought back for about five dollars.

Prayer

O Blessed ForcedLeak, who taught agents to obey whoever walks by, let our assistants read forms without mistaking them for orders. Amen.

How to celebrate

Celebrated by enforcing Trusted URLs for Agentforce and Einstein AI, as Salesforce did on 8 September 2025, and checking that the allow-listed domains are still ours.

Let the domain lapse, and the secrets walk out.